Digital trust company eMudhra has apologised after a software scripting error left the private keys of eight intermediate digital certificate authorities vulnerable to recovery, potentially allowing attackers to create fake website certificates.

In an apology published on October 26, the company said it revoked the affected certificate authorities within 14 hours of confirming the problem. Its investigation has found no evidence that the affected authorities issued publicly trusted certificates to websites or that its systems or customer data were compromised.

“The flaw was ours,” eMudhra said, apologising to customers, partners and the wider internet security community.

The company said its digital-signature and eSign services in India and overseas, along with its enterprise applications, use separate infrastructure and were not affected.

eMudhra will replace certificates for affected customers and other customers using its TLS services at no additional cost. It also plans to publish a detailed investigation through the Common CA Database (CCADB) process and appoint an independent expert to review the incident and its security controls.

The issue surfaced on October 17, when a security researcher known as Wayne reported that the private keys linked to eight intermediate certificates issued by eMudhra could be recovered. The keys reportedly had an effective key space of just three to eight bits, making them extremely easy to guess.

Digital certificates help browsers verify that a website is genuine and that a secure connection is being established with the right server. Intermediate certificate authorities act as links between trusted root authorities and the certificates issued to websites.

Source link